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Abstract 

State of the art programmable devices are utilizing 
advanced processing technologies, non-standard circuit 
structures, and unique electrical elements in commercial-off- 
the-shelf (COTS)-based, high-performance devices. This 
paper will discuss that the above factors, coupled with the 
systems application environment, have a strong interplay that 
affect the radiation hardness of programmable devices and 
have resultant system impacts in (1) reliability of the 
unprogrammed, biased antifuse for heavy ions (rupture), (2) 
logic upset manifesting itself as clock upset, and (3) 
configuration upset. General radiation characteristics of 
advanced technologies are examined and manufacturers’ 
modifications to their COTS-based and their impact on future 
programmable devices will be analyzed. 

I. Introduction 

Programmable logic has become ubiquitous in spacecraft 
electronic designs as they are inherently flexible and provide 
systems designers the tools to meet the new trend towards 
higher integration and performance with decreasing costs and 
development time. This is not unique to spacecraft 
electronics as programmable device development is primarily 
driven by the commercial sector. As such, the devices are 
becoming increasingly sophisticated architecturally, utilizing 
unique circuit structures, and are using the most advanced 
technologies. 

Commercial programmable logic devices are utilizing 
advanced technologies, with manufacturers offering 0.35 pm 
and 0.25 pm products, with improved performance levels 
allowing them to replace ASICs in some applications. For 
spaceflight electronics, these devices have the potential to 
efficiently implement circuits in demanding applications such 
as laser altimetry, photon pulse counting, and time-of-flight 
electronics. 

As the requirements for increased performance drive 
device development, we see new structures such as phase- 
locked loops, both digital and analog, as an example. While 
providing greater system performance by de-skewing clocks 
and providing clock multiplication capabilities, these 
structures may be susceptible to new radiation effects. Clock 
integrity is critical for system applications and we have 


examined and analyzed several cases of logic upset in clock 
circuitry. Modifications were required and made to the 
commercial circuits to reduce device sensitivities to heavy 
ions. 

High-speed interconnections can be made with metal-to- 
metal antifuses, utilizing current processing technologies 
such as chemical-mechanical polishing (CMP). While these 
antifuses are biased with relatively low electric field 
strengths, preliminary studies have shown that these unique 
structures are susceptible to rupture [1]. Various “recipes” for 
these elements are explored and data is shown for a high- 
speed, radiation-hardened antifuse. 

FPGAs, in particular, are now using some of the most 
advanced technologies, scaling internal features and 
improving performance with some devices operating at lower 
core voltages. We have seen what is probably the last 
generation of 5 V devices being produced at their limit of 
0.45 pm, the 40MX and 42MX series. All of the major 
manufacturers have deep sub-micron devices, generally in the 
0.35 pm technology, some with 0.25 pm features, running at 
a 3.3 V core voltage. The state-of-the-art is the announced 
0.18 pm device from Vantis (AMD), the VF1 series; this 
device runs at a core voltage of 2.5 VDC. 

The lower core voltages are attractive to system designers 
because of their high speed and lower power consumption, 
power being a function of V 2 . The effects on the SEU and 
total dose characteristics are studied and are relatively 
consistent across manufacturers and foundries. Note 
however, that these advanced devices, to be usable in 
practical systems, retain an input tolerance of 5.5 volts, a 
concern for gate rupture in these deep sub-micron processes, 
requiring special circuit structures to prevent breakdown and 
conduction to the V D d rail. 

Configuration upset has been predicted, detected, and 
analyzed in FPGAs. While the commercial circuit structures 
are specifically designed for robust behavior in the industrial 
environment, many design implementations do not handle 
faults well in the heavy ion environment. 

A variety of devices were evaluated in this paper. Some 
are off-the-shelf production devices; others are either pre- 
production devices or early prototypes. Applications to a 
specific product should be done carefully as continuing 
technological advancements are being made by the 
manufacturers. 
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II. Rupture 

A. Oxide Nitride Oxide (ONO) Antifuses 

The ONO antifuse is frequently used in non-volatile 
space flight applications. Biased, unprogrammed antifuses 
are susceptible to heavy ion-induced rupture and 
improvements have been made in antifuse design [1J. Recent 
testing has augmented our data set for the hardened antifuse 
in the RH1020, with the production devices' antifuses having 
a 90 A thickness. Results are shown in Figure 1. The beam 
was normal to the die, worst-case, and a fluence of 10 7 
ions/cm 2 used for each run. A significant positive margin 
exists above a bias voltage of 5.5 VDC at an LET of 
37 MeV-cm 2 /mg. This is adequate for most missions and the 
antifuse can be classified as radiation-tolerant; it has 
improved radiation performance over its commercial 
ancestors. 



LET (MeV-cntVmg) 

Figure 1. Summary of antifuse rupture data. Positive margin 
at LET = 37 MeV-cm2/mg is shown for production RH1020 
with a hardened ONO antifuse. One "recipe" of an M2M 
antifuse did not fail at LET = 82 MeV-cm2/mg, 
Vbias = 400 mV. 

B. Metal-to-Metal (M2M) Antifuses 

Metal-to-metal antifuses hold performance advantages 
over the ONO version; programmed resistance’s are -25-50 
ohms versus -100-500 ohms for FPGA implementations. 
M2M antifuse resistance is < 1 ohm for the less density- 
critical programmable substrates. These devices are enabled 
by advances in processing technologies that are critical for 
controlling the thickness of the programmable elements. 
References [1-3] discuss their hardness to total dose effects. 

While ONO antifuse thickness is of the order of 100 A, 
M2M antifuse thickness typically varies from 500 A to 
1000 A, resulting in a decreased electric field strength of a 
factor of 5 to 10, assuming equal bias voltages. This 
assumption is not valid for current devices. Programmable 


substrates program at approximately 30 VDC supporting 
analog supply voltages of ± 1 2 VDC; careful routing ensures 
that no anti fuse sees more than a 12 VDC bias. Recent M2M 
antifuse FPGAs operate at lower voltages, further decreasing 
the electric field strength in the biased antifuse by 35%. 
Reliability studies conducted on M2M antifuses [2, 4. 5] show 
MTBF as a function of bias voltage. 

Antifuse rupture data is a function of heavy ion LET and 
electric field strength [1] and the failure points of some of the 
amorphous silicon antifuses occur at a far lower electric field 
strength than either the ONO antifuses or the Si0 2 reference 
data [6], Failure analysis, using several different techniques, 
has been conducted, assisting in the determination of failure 
and investigation of the mechanisms. Emission microscope 
techniques have proven successful for ONO antifuse and a 
liquid crystal methodology for a variety of M2M damaged 
antifuses, fji addition, current-voltage curves for damaged 
antifuses vaiy by construction. 

To expand on our results, a next generation DUT card 
has been built with new devices designed and fabricated for 
M2M antifvses. Devices that have been tested include the 
QL3025, prototype A54SX16, RT54SX16, and the 

RH54SX16's, and the UT22VP10. The QL3025 is a 3.3 V, 
0.35 pm device fabricated at TSMC. Each of the SX 
prototypes rses a different antifuse "recipe" for these 
experiments The A54SX16 is also a 3.3 V, 0.35 pm device 
while the PT54SX16 and the RH54SX16 are both 3.3 V, 
0.6 pm devices. These devices all have 5 volt-tolerant I/O, 
supported by a 5 V bias, and have a 3.3 V core. The 
UT22VP10 ;S a 5 V PAL; the test data for this device was 
inconclusive and will not be discussed in this paper. The 
QL3025 had significant latchup problems, preventing an 
analysis of their antifuse structure. 

Results for the three SX M2M antifuse prototypes is 
shown in Fi gure 1 where the bottom reference line is set at 
3.6 volts, the maximum rated voltage for this technology. At 
a LET of 37 MeV-cm 2 /mg, all of the devices showed 
significant positive margins, with no damage detected, giving 
SEU-tolerant performance. At the higher LETs, differences 
are observed between the three variants, with two of the 
devices failing at an LET of 45 MeV-cm 2 /mg. 

The significant result is the performance of “recipe M.” 
Several lots were tested, showing radiation-hard performance, 
no damage at an LET of 82 MeV-cm 2 /mg. Additional 
margin for t iis design was demonstrated by increasing the 
bias voltage to 4.0 VDC, 11% greater than the rated 
maximum. Further experiments are planned which will test 
the effects of different variants of the recipes to give further 
insight into the mechanism. 

Testing techniques are similar for the ONO and M2M 
antifuses although damage to the M2M-based structures are 
far easier to detect. These structures, designed for lower 
programmed impedances, also have lower impedances when 
damaged by a heavy ion. Despite the higher bias across the 
ONO structure, the current draw by a damaged M2M 
structure is many times higher. 
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III. Logic Upset 

A. Introduction 

Logic upset is s a transient pulse from a single ion strike. 
This can occur in combinational circuits or global resources 
such as clock and reset lines. Previously, logic upset was 
observed in an FPGA but cross-sections were not determined. 

B. Logic Upset Examples and Instrumentation 

Gate upsets in the RH1280 were observed when running 
at a reduced supply voltage of 3.3 VDC ± 10%; there were no 
logic upsets when running at supply voltages > 4.5 VDC. 
Failures occurred in the voter circuits of TMR strings and 
correlation with on-chip error monitors confirmed logic 
upset. This is an example of a data upset, with the glitch or 
runt pulse arriving at the input to the flip-flop during the 
critical time when the data is latched, typically a small 
fraction of a nanosecond. There was no effort to harden the 
logic circuits of the RH1280, originally a commercial design. 

The CX2041 (0.6 pm), was evaluated for SEE at a bias of 
3.3 VDC. In this device, a low-skew clock tree is built and 
balanced to support user flip-flops. During heavy ion 
irradiation, large numbers of errors appeared in bursts with 
some errors disrupting the entire chip, indicating disruption 
to the clock distribution network. Errors were observed 
simultaneously in several independent shift register strings, 
with the only common element being the clock tree! 
Additionally, few errors were reported on the SEU monitor of 
our SEU-haniened shift register [1], while the shift register 
itself gave burst errors. This is an example of a clock upset. 

The DUT stimulus pattern is critical for detecting clock 
upsets: all ‘l’s or all ‘0’s are useful for detecting pattern 
sensitivity in flip-flops but will mask clock upsets since an 
extra clock will be undetected. Similarly, a Johnson twisted 
ring counter, with at most one ' 1 1 - ' 0 ' transitions, will have 
trouble distinguishing clock upsets from SEUs. 

SEU time-tagging has been added to our test equipment, 
permitting both SEUs and logic or clock upsets to be 
measured simultaneously. Sample output from an RH1020 
run is shown in Figure 2, where error counts for each of the 
three monitors is plotted against sample number, with 
approximately 250 ps between sampling points. The 
unhardened shift register’s error counts (DOS) rise linearly 
and then jump approximately 17 counts, one-half the length 
of the shift register. Concurrent with this jump, the hardened 
output’s error count (DOH) undergoes a similar jump and 
stays flat, as it rejects SEU’s. Note that the hardened shift 
registers SEU monitor (TMR MON) never jumps, and rises 
linearly with time, showing a relatively constant error rate in 
the flip-flop elements. By taking the first derivative of the 
error count with respect to sample number, the number of 
clock upsets may be counted and the number of upsets 
attributed to clock upset may be removed from the total error 
count, permitting an accurate assessment of flip-flop SEU 
sensitivity as shown in Figure 3. 


C. RH 1020 Logic Upset Analysis and Mitigation 

The clock upset cross-section in pre-production models of 
the RH1020 is significantly higher than that of it’s 
commercial cousin, the A1020B (1.0 pm device). This is 
thought to be attributed to moving the design to the higher 
performance radiation-hardened process, where small runt 
pulses propagate easier and flip-flops respond to signals with 
a smaller pulse width and amplitude [7J. 
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Figure 2. Clock upset in the RH1020 with each SEU time- 
tagged. The concurrent jumps on DOS and DOH, two 
independent circuits, indicate clocks upset, as the clock is the 
common element 



Error Event Number 

Figure 3. Quantitative analysis of clock upset raw data It is 
performed by plotting the sample-to-sample differences in the 
errors counters 

Although a channeled architecture with individual 
buffers and clock lines for each row, the A1020B/RH1020 
shorts the outputs of the buffers together to minimize clock 
skew, resulting in many common points to the distribution 
network. The earlier A1020 (2.0 pm) and A1020A (1.2 pm) 
devices had isolated row buffers and similar error signatures 
indicated that the upsets were present in the input stage, not 
in one of the clock row drivers. A number of analytical and 
experimental techniques such as laser stimulation and using a 
focused ion beam (FIB) to perform circuit modifications 
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further isolated the sensitive region to a TTL-compatible 
input stage employing a small amount of hysteresis. 

Analysis of transistor sizes and clock upset cross-sections 
led to the preliminary conclusion that the upset was 
happening on the clock’s transition. Several experiments 
were run to verify this. During heavy ion irradiation, the 
input was held at either rail, with few clock upsets detected 
with the clock input grounded. This dependence is consistent 
with transistor-level circuit analysis, which showed a strong 
asymmetry, typical of TTL-level inputs, and laboratory noise 
testing on the input stage. This conclusion was confirmed 
with heavy ion irradiation by measuring the frequency 
dependence of the upset as shown in Figure 4, with four 
devices tested from 10 kHz to 1 MHz, each run having a 
fluence of 10 7 ions/cm 2 . The large part-to-part variation in 
Figure 4 is typical for this effect, as the propagation of a clock 
runt pulse and acceptance by a flip-flop is marginal and 
dependent on specific device parameters. Analysis of the 
number of upsets per hit, usually about one-half of the shift 
register length, confirms this as a runt pulse, consistent with 
other laboratory tests and circuit analyses. 



Clock Frequency (Hz) 

Figure 4. RH1020 (pre-production devices) input buffer 
transients resulting in "clock upsets." The upset occurs on the 
transition and is shown here as a frequency dependence 

While this phenomenon has been referred to as “clock 
upset,” we refer to it in the more general sense as “logic 
upset.” An examination of the schematics for non-dedicated 
I/O stages showed a similar circuit construction to the 
dedicated clock input pin on the 1020 series. A special DUT 
was designed and constructed to verify this I/O module’s 
sensitivity. Since regular I/O pins in the RH1020 do not 
permit access to a low-skew signal distribution network, flip- 
flops were hand-placed so that the clock input for each of the 
flip-flops was attached to the same routing segment and no 
skew was confirmed with the static timing analyzer. While 
detailed cross-sections were not measured as a result of 
limited test time, upset on these I/O pins was detected, 
confirming the analysis’ conclusion that the fault was in the 
input stage and not in the clock distribution network. These 
’’non-clock” pins will show an edge SEU sensitivity since 


typical circuit applications such as ripple event counters use 
these pins as clocks. 

Based on circuit analysis and SPICE simulations, along 
with the heavy ion, laser, and laboratory tests on A 1020, 
A1020A, AI020B, and RH1020 (including those with 
modified circuits using the FIB), a new production lot was 
fabricated, with the original commercial TTL-compatible 
input circuit design modified to mitigate the logic upset. 
While the cross-section of the original devices was low 
approximately 10- 6 cnr/Clock, the modifications resulted in a 
reduction by an order of magnitude. Figure 5 shows the 
results, plotting both typical pre-production data vs. an 
average of five production devices. Clock upset was also 
detected in the A1020, A1020A, A1020B, and CX2041 
microcircuits. 



LET (MeV-cm J /mg) 

Figure 5. Clock upset performance of pre-production and 
production RH1020 devices. The production devices had a 
modified input circuit for improved SEE performance 

IV. CONFIGURATION UPSET 
A. Introduction 

For many types of microcircuits, the mode and the 
control of the chip may be configured in a variety of ways. 
The configuration of a field programmable gate array may be 
controlled by an antifuse, an SRAM cell, a non-volatile 
memory cell, or a combination of these technologies. 
Advanced mcrocircuits may contain various test modes as 
well as functions reserved for the manufacturer, such as 
device identification or programming. 

Configuration bits may be susceptible to SEUs and a loss 
of control of the integrated circuit may result. Reference [8] 
gives a good overview of this type of effect and shows failure 
modes for an AT28C010 EEPROM, which fall into two 
classes of failures. One class corresponds to an SEU in the 
output data register. A second class, consisting of two 
distinct sub-classes, led to a semi-permanent loss of control 
and an increaie of supply current. 
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B . Analysis of a Configuration Upset 


SERIAL INPUT SERIAL OUTPUT 


Tests were run on prototype FPGAs. The devices 
would, when irradiated with heavy ions, apparently lose all 
functionality until the power was cycled, accompanied by 
changes in the device current. The following section will 
determine the failure mechanism as well as discuss test and 
analysis techniques. These prototype devices implement a 
new architecture for this manufacturer with test samples 
utilizing two different scaling factories and three different 
foundries. 

A representative run showing one class of error 
signatures is shown in Figure 6. A 5 V bias is used for 5 volt- 
tolerant I/O and a 3.3 V bias powers the array core and output 
drivers. Large currents were observed and remained until the 
device's power was cycled. In some cases, the current draw 
exceeded 800 mA, the programmed setting for the power 
supply. Although this current rise is often a result of SEL, no 
determination was immediately made. Similar results were 
seen on devices from several foundries and the device 
irradiated in Figure 6 was from a radiation-hardened line 
using a 2 pm epitaxial layer. The design rules for the device 
were consistent with good latchup performance and the small 
failure cross-section suggested a different mechanism. Other 
failure signatures were observed, again with an apparent loss 
of functionality. One class shows the current levels dropping 
from their active state to quiescent levels. 



Figure 6. Strip chart during irradiation of a prototype FPGA 
produced on a radiation-hardened, 2 pm epi line. The current 
on some runs exceeded 800 mA and was caused by a 
configuration error from an SEU in the 1 149. 1 TAP controller. 

It has been determined that these two cases have a 
common cause, and is a result of the IEEE JTAG 1 149. 1 TAP 
[9] specification and implementation. This standard specifies 
the interface and operation of features to support test and 
other operations at the board and device level. 

An overview of the 4 1 149. 1 * scan configuration is shown 
in Figure 7, with a set of cells between the device’s pins and 
the internal core logic. This permits various operations such 
as sampling the devices inputs, driving the external pins to 
known values, or presenting test inputs to the device core. 
The scan cells form a data register and are configured as a 
shift register. Other 1149.1 functions include device 
identification and other device specific features such as built- 
in self test (BIST), programming, etc. 
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Figure 7. The IEEE JTAG 1 149. 1 scan architecture. The logic 
core is surrounded by the scan cells, which can perform normal 
I/O functions or be controlled from the test access port (TAP). 



Figure 8. An SEU in the TAP controller. Undefined data is 
loaded into the output of the Instruction Register causing an 
apparent loss of functionality. 

The test access port (TAP) controller commands the test 
interface and registers with a sixteen-state sequencer. Figure 
8 shows a simplified diagram of the basic configuration as it 
is typically implemented, without the hard reset pin (TRST!, 
which is optional in the standard), along with the instruction 
register. The output of the instruction register controls the 
device and consists of two sections, a shift register for serial 
loading and a parallel latch to hold the instruction, which is 
loaded and cleared on command from the TAP controller. 
The JTAG nomenclature defines TCK as the clock to the 
TAP controller, TDI is test data in, and TDO is test data out. 
TMS (mode pin. not shown) guides transitions in the TAP 
controller. 

State assignments for the TAP controller may be 
arbitrarily selected with the states and transitions rigidly 
defined in the specification. The Test-Logic-Reset state is 
used for normal operations with the TAP controller asserting 
RESET, forcing the output latch to load an instruction which 
does not affect the device’s operation. An analysis of the 
TAP controller’s state diagram shows a well-designed, robust 
controller for commercial and industrial applications, tolerant 
of faults that would be expected in these environments (such 
as pins being shorted) and no lock-up states. All paths will 
return the machine to the Test-Logic-Reset state within 5 
TCK cycles with TMS held high. However, when analyzing 
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the state diagram for SEU sensitivity, the machine will return 
to the Test-Logic-Reset state, but, if the appropriate state bit 
is upset, via a path that moves through Update-IR, which 
latches new data into the instruction register’s latch, giving 
the microcircuit a new command mode or configuration. 
Analysis of the state assignment used in the prototype devices 
tested showed that a single bit error could force sequencing 
through the Update-IR state. 

Note in Figure 8 that the shift register located in the 
instruction register is not held in reset when the TAP 
controller is in the Test-Logic-Reset state. This is consistent 
with the 1149.1 specification, which states that the shift 
register is undefined in that state, amongst others, with the 
authors of the specifications not anticipating SEUs. When an 
SEU flips a bit in the TAP controller and the Update-IR is 
traversed, arbitrary values are loaded into the IR register, 
with an unpredictable effect on the chips operation and state. 

The small number of susceptible bits in the TAP 
controller is consistent with the failure rate during heavy ion 
irradiation. However, latchup was not immediately ruled out, 
as we kept open the possibility that a design rule may have 
been violated in one spot which was not caught by the design 
rule checker. The next experiment used a 6 kHz clock 
driving the TCK pin with TMS held high. 6 kHz was 
selected to facilitate instrumentation while having a minimal 
probability of two upsets in the 5 TCK sequence. In this 
mode the device experienced functional failures during 
irradiation but power cycling was not required to restore the 
device to an operational mode, as would be required after a 
SEL. Note that each device must be analyzed to ensure that 
damage can not result from operation in this mode and that a 
higher frequency for TCK should be used if devices with this 
design are flown. 

The failure mechanism was further investigated by 
placing the instrumentation in time-tagging mode with the 
6 kHz signal driving TCK. Sample results are shown in 
Figure 9, with the outputs of error counters shown for the two 
independent flip-flop strings, sampled at approximately 
4 kHz. Three jumps are seen, with both error counters 
changing simultaneously and in equal amounts, similar to 
that seen from a clock upset, discussed above in Section EH. 

A closer examination and further tests with various DUT 
stimulus proved that this similar signature could not have 
been clock upset. Examination of the error counts showed 
sizes that were too large to suggest clock upset for the length 
of the shift registers and clock frequencies used. However, a 
brief oscillation of the clock buffer could not be ruled out, 
with perhaps multiple transitions. The next test was to 
decrease the TCK frequency by an order of magnitude and 
observe the frequency of configuration losses and the 
magnitude of the jumps. By examining the error counts, 
which are based by the 1 MHz DUT clock, the period of time 
of the malfunction can be determined precisely. This, 
coupled with decreasing the TCK frequency by an order of 
magnitude, resulted in the rate of configuration upsets 
remaining constant but the size of the jumps increased. The 
longer periods of loss of functionality would not have 


occurred ir clock upset, which is an asynchronous affect. 
Lastly, additional runs and changes in the input patterns 
resulted in data sets where only one of the two shift registers 
experienced the jumps in error counts. In this mode, by 
holding the data constant, for example, a matching value in 
the boundary scan register would show no errors while a fault 
was occurring. 



Figure 9. Transient functional failures of a prototype FPGA 
incorporating 1 149.1 circuitry. The duration of the failure is a 
function of the TCK frequency. 


V. Radiation Test Results And Analysis 

This section will summarize, discuss, and analyze recent 
radiation test results of a more general character than the 
sections above. Tests continue on existing programmable 
products to support on-going flight programs and emerging 
trends. On the advanced technology front, the first deep sub- 
micron programmable data is presented which show 
radiation-tolerant performance for some parameters. With 
slight modifications made to the commercial foundry's 
process, radiation-hard performance levels were obtained. 

A. Heavy Ion and Proton Induced SEU 

1) Heavy Ion Effects and Analysis 

The RH .020, which is based on the A1020B commercial 
design, has recently been characterized for SEU performance. 
The SEU performance of the A1020B is heavily influenced by 
the Act 1 architecture, which contains no hard-wired flip- 
flops; latches are made by feeding back the output of the 4:1 
multiplexor element back to its input via the routing channels 
and through antifuses. Radiation-tolerant performance is 
obtained since the pre-laid routing tracks have a parasitic 
capacitance ; nd the antifuses have parasitic resistance which 
act as a filter The weakness of this architecture with respect 
to SEU is the design of the module resulting in very 
asymmetrical behavior, an artifact of its commercial origins, 
with the weaker state dominating the upset rate. The 
RH1020. fabricated on the Lockheed-Martin Federal Systems 
(LMFS) 5 pm epitaxial process would be expected to have 
similar SEU performance to its commercial equivalent. The 
data shown n Figure 10 shows this. Similarly, the Act 2 
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A1280A and RH1280 show similar heavy ion SEU 
performance. 

A similar analysis can be applied to two quick-turn ASIC 
families, the QYH500 (0.8 pm) and the CX2001 (0.6 pm), 
produced by Chip Express. Neither series contains hard- 
wired or dedicated flip-flops with the NAND-based QYH500 
giving superior SEU performance to the coarser grained, 
multiplexor-based CX2001. Sensitive circuit nodes internal 
to the CX2001 logic module may be hit by an SEU, without 
the parasitic capacitance of a routing track adding to the 
storage elements SEU response time as in the QYH500, 
which has excellent SEU characteristics. It is interesting to 
compare the CX2001 and Act 1 architectures, which are very 
similar, and it can be expected that the mechanism leading to 
the vulnerability of the Act 1 module leads to the SEU 
performance of the CX200 1 module. 



Figure 10. Comparison of SEU performance for devices 
fabricated at commercial (MEC) and radiation-hardened 
(LMFS) foundries. 
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Figure 11. SEU Response of hard- wired flip-flops at 1.0 pm, 
0.6 pm, and 0.35 pm feature sizes. The 1.0 pm device has a 
nominal 5 V bias; the others have a 3.3 V nominal bias. 


Utilizing prototype RT54SX16 and A54SX16 devices, we 
can further measure and analyze the SEU performance of 
3.3V technology components down to 0.35 pm feature sizes. 
Last year’s study [1] of 0.6 pm devices utilized a small 


pattern oriented towards reliability testing; this study uses 
pre-production devices with 400 flip-flops per OUT, giving 
more accurate thresholds and cross-sections with the results 
summarized in Figure 11. Both of the 3 3 V sea-of-modules 
devices, with the more symmetrical circuit designs, 
outperform the 5 V 1.0 pin A1280A. Interestingly, the 
0.35 pm A54SX16 prototype outperforms the 0.6 pm 
RT54SX16 prototype with both devices having identical test 
patterns programmed. 

2) Proton Effects and Analysis 

A number of programmable devices have been tested for 
proton sensitivity and Table 1 gives estimates of cross- 
sections for approximately 195 MeV protons. The A1280A 
has been tested previously. A review of the data and test 
plan, along with the low heavy ion upset threshold for the 
hard-wired flip-flops, led us to repeat this test using an array 
of 19 devices from four different production lot date codes. 
Each of these devices upset, with runs being conducted at 
both the worst-case 4.5 VDC and nominal 5.0 VDC supplies. 
The A1280A results are discussed in detail in [10]. 

Table 1 . Proton Sensitivities at 1 95 MeV 


Device Type 

Size/Voltage 
(nominal core) 

Est. X-Sec 
(cm 2 /f-f) 

Comments 

A1280A 

1.0 mn/5.0V 

~ 137 x 10 l5 

19 devices 

RH1020 

1.0 um/5.0V 

< 2 x 10 15 


RH1280 

0.8 um/5.0V 

~400xl0‘ 5 

S-Module 

QYH500 

> 

n 

! 

00 

o 

< 0.5 x 10' 15 

No upsets 

RT54SX16 

0.6 um/3.3V 

~6 x 10' 13 


QL3025 

0.35um/3.3V 

<4x 10' 1 ’ 

No upsets 

A54SX16 

0.35um/3.3V 

~ 3 x 10 15 


JT22VP10 

N/A/5.0V 

~2x 10 11 

Cypress die 


The behavior of the radiation-hardened FPGAs is 
examined for proton upset. The RH1280, based on the 
commercial A1280XL, has a relatively large upset cross- 
section, as the device was not modified for SEU hardness. 
The RH1020, based on the commercial A1020B, is also 
susceptible. The 3.3 VDC small feature-sized 
commercial devices did relatively well, with upset cross- 
sections having the same order of magnitude as the 5.0 V 
RH1020 which utilizes routed flip-flops. No upsets were 
detected in the QL3025’s, consistent with the heavy ion tests, 
where no upsets were detected with ions having a LET of 
18.8 MeV-cm 2 /mg, although total fluence was low because of 
SEL problems. The cross-sections of the prototype 
RT54SX16 and the A54SX16 are low, consistent with the 
heavy ion data of Figure 1 1 . 

Lastly, as seen in Table 1, no upsets were detected for 
QYH530 ASICs, with devices selected from two one-mask 
production lots. The devices in this test configuration were 
operated at 3.3 volts. 

3) SPAM Configuration Memory Analysis 

SRAM-based FPGAs are configured by loading state 
information into SRAM cells are popular commercially and. 
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as discussed below, arc the subject of several development 
efforts for space flight electronics. These SRAM-based 
devices currently hold a density edge for commercial devices, 
even taking various gate counting methodologies into 
account. However, for a radiation-hard device utilizing 
existing architectures, there will, for the near-term at least, be 
restrictions on device density. 



Figure 12. Number of configuration bits vs. gate count for four 
families of FPGAs. Architectures show different "efficiencies" 
per configuration bit. 


The commercial SRAM-based FPGA vendors each take a 
differing approach to their architecture, offering structures 
such as lot* up table (LUT)-based and logic-based modules, 
different module granularity, etc. An analysis of almost all 
available and announced devices shows that the ratio of user 
flip-flops to user on-chip SRAM to configuration memory is a 
constant, with approximately an order of magnitude between 
each storage type. Focusing on the configuration memory bits 
that dominate, we can see the linear increase in configuration 
storage as a function of device capacity in Figure 12. The 
slopes of these curves gives a measure of the configuration bit 
efficiency for each architecture that is critical for assessing 
the impact of producing a radiation-hardened device. Even at 
the 100 kgate density level, we can see a range of 
configuration bits from below 500 x 10 3 to almost 2 x 10 6 . 
Extrapolating to higher device densities, it is clear that 
radiation-hardened devices are not practical for state of the 
art commercial technologies. SEU-tolerant applications, as 
discussed in [1], would employ checking circuits to verify the 
contents of configuration memory and take corrective action 
in the case of a fault. It would have to be shown that no 
permanent circuit damage would occur. The system design 
would have to be tolerant of a pause in circuit operation if a 
reload or partial reload is necessary and prevent any 
erroneous signals from propagating to a critical part of the 
system. As device geometries continue to shrink, reducing 
the 'cost' of the silicon, it may become feasible to provide a 
TMR plus voter for each configuration bit with a non- 
intrusive, on-chip background process scrubbing the 
configuration memories. 


4) Mitigation Technology 

TMR :'or user FPGA circuits has been discussed and 
analyzed in [ 1 1 and while not resource efficient, it is used for 
the effective SEU-hardening of flip-flops. As the commercial 
industry has moved toward hardware description languages 
(HDLs) such as VHDL. designers were locked into tedious 
schematic-tased solutions. Over the past year, modifications 
and scripts for commercial software have been released, 
offering a choice of HDL tools as well as macro generators 
and custom schematic libraries. Typically, the designer may 
select levels of SEU hardening, such as limiting flip-flop 
selection to ‘C-Modules” or by selecting TMR structures. 

B. Single Event Latchup 

Recent latchup test results are shown in Table 2. 
Destructive effects were observed for the two Quicklogic 
devices, the QL24x32 and the QL3025. The 0.65 pm series 
Cypress device had been tested previously with similar 
results. The QL3025 is a member of the new pASIC3 family, 
utilizing a 0 35 pm TSMC process. 

Quick-turn ASIC prototypes are configured by 'laser 
programming' while flight devices are processed with a one- 
mask technology. The one-mask QYH530’s performed 
similar to the LPGA devices which were tested in [1], with 
SEL LET thresholds of approximately 60 MeV-cm 2 /mg. The 
thin-epi 012041 LPGA devices easily latched, both at 
VCC = 5.0 and 3.3 volts. Recent testing did not detect 
latchup at a LET of 37 MeV-cm 2 /mg when biased at 2.5 volts. 

Lastly, while commercial XC3090’s had a SEL threshold 
of approximately 4-7 MeV-cm 2 /mg [1], the specially 
processed XQR4036XL prototype showed no latchup at an 
LET of 100 MeV-cm 2 /mg at a temperature of 125°C, showing 
radiation-hard performance for this parameter [11], 


Table 2. Latchup Summary 


Device Type 

Size/Voltage 
(nominal core) 

Threshold 

(MeV-cm 2 /mg) 

Comments 

RH1020 

1.0 nm/5.0V 

>74 


QL24x32B 

0.65um/5.0V 

< 18 

Destructive 

RT54SX16 

0.6 nm/3.3V 

>82 


QYH530 

0.8 nm/5.0V 

- 52 

One-Mask 

CX2041 

0.6 Mm/2.5V 

>37 

LPGA 

A54SX16 

0.35nm/3.3V 

>74 


QL3025 

0.35um/3.3V 

< 11 

Destructive 

XQR4036XL 

0.35nnv3.3V 

> 100 



C. Total Dose 

Lot-specific total dose testing is used to support on-going 
NASA flight programs. The 1.0 pm A1280A/MEC and the 
0.8 pm A14100A/MEC are popular devices with space flight 
designers utlizing commercial/military-grade technologies. 
We have seen performance for the A 1280 A and the A14100A 
(Act 3) of about 7-10 krads (Si) and greater than 20 krads (Si) 
respectively. Recent test data show the start of a trend, with 
severely decreased TID performance for recently fabricated 
A1280A. AU60A, and A14100A die. 
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Recent data is shown in Figure 13 for new 0.35 pm 
3.3 VDC. 0.45 pm 5.0 VDC, and 0.6 pm 3.3 VDC devices. 
The 5 V A42MX09 did poorly at about 6 krads (Si) while the 
3 3V core devices all showed solid radiation-tolerant 
performance. Of note is the specially processed 0.35 pm 
XQR4036XL, which passed the 60 krad (Si) point with no 
parametric or functional failures. Devices have been 
submitted for product analysis as it is thought the reduction in 
specific structure dimensions has played a role in the 
increased total dose performance of these four 3.3 V device 
types, clearly indicating a trend. 0.35 pm, 3.3 VDC CX3001 
prototype performance results will soon be added to our 
database. 



Figure 13. TTD performance for new and prototype DUTs. 
COTS produced devices with a 3.3 volt core exhibited 
radiation-tolerant performance; a modified COTS device 
passed at > 100 krads (Si). 

Process modifications have been made to the prototype 
RT54SX16, with three splits of our test lot. Split 'A' was 
fabricated unmodified from the typical process, and lot splits 
‘B’ and ‘D’ represent different levels of modification. A 
series of experiments validated the predictions, with improved 
total ionizing dose performance. With very conservative test 
standards and no annealing, lot split ‘B’ passed at 80 krads 
(Si) and lot split ‘D’ easily passed at the 100 krads (Si) level. 
This experiment shows the potential for a modified COTS 
part exhibiting radiation-hard, total dose performance. 

Further testing has been conducted on the 0.8 pm 
QYH500/Yamaha series. Previous testing [1] used laser 
programmed parts useful for rapid prototyping. Recent 
testing on two lots of “one-mask” devices, which are 
programmed with a single etch and are passivated, had 
performance levels of 1 5 to 30 krads (Si). The same DUT 
logic design was put into the more architecturally attractive 
0.6 pm CX204 1/Tower device, showing a total dose 
capability of approximately 7 krads (Si). Based on the results 
of the prototype deep sub-micron FPGAs, we will next 
evaluate the 0.35 pm CX3001/CSM family. 


VI. Hardening Efforts 

A. RH 1 020 and RHl 280 Devices 

Over the last few years. RH series devices have been 
produced, using Lockheed-Martin Federal Systems as a 
foundry. Initially the commercial design was to be used, 
which kept the COTS design intact, achieving total dose 
hardness from the use of the LMFS process. While the 
A1020B 10 pm epi device does latchup (12], qualification 
testing on the RHI020 5 pm epi process showed no sign of 
latchup and excellent total dose performance. 

Based on the susceptibility of the ONO antifuse to 
rupture as a result of heavy ions [12], the antifuse thickness in 
the RH series was changed, decreasing the electric field 
strength which provides a more radiation-tolerant solution. 
Section III discussed the vulnerability of the RH1020’s input 
buffer to single event transients and the improvements gained 
by redesigning the circuits. No effort was made to harden the 
storage elements with SEU performance ranging from low 
tolerance to “rad-tolerant” levels. 

B. CGaAs CLAy-10 

The goal of the AFRL/N AS A/Motorola/SPEC 

complementary GaAs FPGA is to provide for low power, high 
speed, electronics for communication applications. Using 
0.7 pm low temperature technology, it is planned to achieve 
350 MHz performance using a 1.5 VDC power supply with 
no SEL, an SEU LET > 20 MeV-cm 2 /mg, and a total dose 
hardness exceeding 100 Mrads. The device is architecturally 
based on the re-programmable National Semiconductor 
CLAY-10 architecture. 

C. SOI AT60 10 

This NASA/SNL/Honeywell/Atmel program will 
radiation-harden the AT6010 using a Honeywell silicon-on- 
insulator process. Goals for the program include a total dose 
hardness exceeding 200 krads (Si), no SEL, and an SEU 
threshold of > 30 MeV-cm 2 /mg for both user storage and the 
configuration elements. This FPGA will be a 5 V device. 

D. XOR4000XL 

By special processing, the XQR4036XL, a 0.35 pm 
device, as discussed in Section V, has demonstrated a total 
dose capability of 60 krads (Si) while meeting functional and 
parametric specifications. No latchup of the 7 pm epi-based 
device was detected at an LET of 100 MeV-cm 2 /mg and a 
temperature of 125°C [13], 

E. RTSXandRHSX 

These 0.6 pm devices are based on the commercial 
A54SX series and have had prototypes tested over the past 
two years. RTSX prototypes are produced at MEC and RHSX 
prototypes are fabricated at LMFS. As discussed in Section 
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V, total dose hardness for the RTSX can be made greater than 
100 krads (Si) and the RHSX prototype easily passes 
200 krads (Si) [l|. A radiation-hardened antifuse structure 
has been demonstrated passing tests at a LET of 
82.3 MeV-cnr/mg. Present design modifications include the 
addition of the optional TRST! line to harden the IEEE JTAG 
1 149. 1 TAP controller and a modified hard-wired flip-flop to 
increase SELF hardness from radiation-tolerant levels to 
radiation-hard. This device operates with a 3.3 VDC core 
and is 5 V-input tolerant. 

VII. Conclusion 

Programmable devices will continue to be of increasing 
importance to spacecraft electronics designers as system 
requirements increase the trend towards higher performance 
electronics with increased processing bandwidth and shorter 
development times. These devices will be required for on- 
board processing of the increasing data volumes from sensors 
that cannot be accommodated by typical data storage and 
compression schemes with the available down link telemetry 
rates. State-of-the-art, commercial programmable devices 
have recently progressed rapidly down the technology curve, 
with operating frequencies rivaling that of high-powered 
discrete designs and ASICs, in many cases. 

Programmable devices can be either custom-designed for 
space applications or rely on commercial technology and its 
associated infrastructure. While most programmable devices 
for space flight are derivatives of commercial designs, the 
LMFS PROM was designed with radiation issues in mind 
utilizing a low (0.1 V) bias across unprogrammed ONO 
antifuses to ensure high-reliability. 

Commercially-derived devices' radiation tolerance range 
from poor to radiation-tolerant, in most cases. Some of the 
radiation hazards stem from structures and technologies that 
are perfectly reliable in the commercial/military sector, such 
as antifuses, TTL-compatible input buffers, flip-flop designs, 
and circuits such as the JTAG TAP controller, as examples. 
Total dose performance of 5.0 VDC devices is highly 
variable, subject to process variations at the commercial 
foundries. 

We have shown that devices' radiation performance 
levels can be increased to radiation-hard levels without the 
use of an expensive radiation-hard process. This is through a 
combination of modification of circuit designs and 
commercial processes. Examples include a radiation- 
hardened antifuse and total dose performance greater than 
100 krads (Si). A number of manufacturers are now actively 
modifying their designs and their foundries' processes to 
increase the radiation performance of commercially produced 
devices 

Within the next few years, the commercially produced, 
modified devices will likely provide solid radiation 
performance for the majority of applications, including high- 
speed processing. Similarly designed devices, produced on 
traditional radiation-hardened lines, will be available for high 
levels of radiation performance. 
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IX. Appendix I. Summary of Devices and Technologies 


Device 

Series 

Foundry 

Conflg. 

Techn. 

Core 

Volt 

■ 

IHSI 

Device 

Series 

Foundry 

Conflg. 

Techn. 

Core 

Volt 

■21 


VF-l 


SRAM 

2.5 

0.18 

CX2041* 

CX2001 

Tower 

METAL 

B1HH 


A40MX02* 


CSM 

ONO 

5 

0.45 

CX3061* 

CX3001 

CSM 


MTU 

0.35 

A42MX09 1 

42MX 

CSM 

ONO 

5 

0.45 

JT22VP10' 1 

PAL 


FUSE 

5 


A1020 1 

Act 1 

MEC 

ONO 

5 

2.0 

MK5HMI 

pASIC 1 

■SSI 

M2M 

5 

0.65 

A1020A 1 

Act 1 

MEC 

ONO 

5 

1.2 

QL3025 5 

PASIC3 

TSMC 

M2M 

3.3 

0.35 

A1020B' 

Act 1 

MEC 

ONO 

5 

1.0 

QYH530 1 

QYH500 

Yamaha 

METAL 

KiH 

0.8 

A1280A 1 

Act 2 

MEC 

ONO 

5 

1.0 

RH1020 1 

Act 1 

LMFS 

ONO 


1.0 


Act 3 

MEC 

ONO 

5 

0.8 

RH1280 1 

Act 2 

MEC 

ONO 

5 

^ 0.8 


Act 3 

MEC 

ONO 

5 

0.8 

RH54SX16 1 

SX 


M2M 

3.3 

0.6 


SX 


M2M 

3.3 

0.35 

RT54SX16 1 

SX 

MEC 

M2M 

3.3 

0.6 


AT28C 

Almel 

EEPROM 

5 


BESS3E9I: 

RadPAL 

UTMC 


5 




Atmel 

SRAM 

5 

0.8 

XQR4036XL 7 

XC4000XL 


SRAM 

3.3 

0.35 


Foundry Information 

CSM: Chartered Semiconductor Manufacturers 

MEC: Matsushita Electric Company 

TSMC: Taiwan Semiconductor Manufacturing Corp. 

LMFS: Lockheed Martin Federal Systems 

UTMC: United Technologies Microelectronics Center 


Device Manufacturers 

1 Actel 

2 Atmel 

3 Chip Express 

4 Cypress 

5 Quicklogic 

6 UTMC 

7 Xilinx 



























































































































